3 years ago, at the start of July
Fraud detection state machine built into OpenX cookie counters
Posted by pbirnie under technology
OpenX ad platform supports ad ops staff configuring limitations in the number of times a user sees an ad in a defined session duration.
I used firebug to inspect the cookies passed on each page request and xdebug on the server. As far I can tell the impression counters use two http requests to detect fraudulent impressions. So the 2 requests set, check and clear values in the cookies - this creates a state machine that will not bump the impression counter unless a ad request is followed by and ad impression (lg.php)
The first request is the request for the ad for a particular zone (and receives cookies as part of this response)
The second request is the impression request - which asks for a 1x1 image (and receives cookies as part of this response)
request for ad for image banner ad AID=1da02e891d41e726c1089be4e17d5ca8; OABLOCK=17.1245857291; sessionID=965ccec6008179bb5b31bea3c2cfe172 ; PHPSESSID=e8629714b631a1a0e0dab302361485d5; OASCAP=17.5; <--- the session (S) level counter for banner 17 is 5 _OASCAP[17]=1; <--- this the marker that the previous impression occured (it is set by the previous lg.php call) _OABLOCK[17]=1245857300 response with banner ad _OABLOCK[17]=deleted; expires=Tue, 24-Jun-2008 15:29:11 GMT; path=/ %5FOABLOCK%5B17%5D=deleted; expires=Tue, 24-Jun-2008 15:29:11 GMT; path=/ _OASCAP[17]=deleted; expires=Tue, 24-Jun-2008 15:29:11 GMT; path=/ %5FOASCAP%5B17%5D=deleted; expires=Tue, 24-Jun-2008 15:29:11 GMT; path=/ OAID=1da02e891d41e726c1089be4e17d5ca8; expires=Thu, 24-Jun-2010 15:29:12 GMT; path=/ OABLOCK=17.1245857300; expires=Fri, 24-Jul-2009 15:29:12 GMT; path=/ OASCAP=17.6; path=/ <----- bump the counter for video ad 17 to a value of 6 (OpenX can see _OASCAP=17.5 AND _OASCAP[17]=1 request to log (lg.php) OAID=1da02e891d41e726c1089be4e17d5ca8; OABLOCK=17.1245857300; sessionID=965ccec6008179bb5b31bea3c2cfe172 PHPSESSID=e8629714b631a1a0e0dab302361485d5 OASCAP=17.6 response from logging (lg.php) OAID=1da02e891d41e726c1089be4e17d5ca8; expires=Thu, 24-Jun-2010 15:29:12 GMT; path=/ _OASCAP[17]=1; path=/ <---- This is marking that the impression occured, for the next request _OABLOCK[17]=1245857352; expires=Fri, 24-Jul-2009 15:29:12 GMT; path=/
